The Found iPhone and the Friday Night Request
A paralegal at a manufacturing client calls you at 4:55 p.m. on Friday. An employee turned in a company-issued iPhone 13 that was left in conference room 4B. The phone is unlocked and shows a text thread with a competing supplier discussing 'taking the customer list.' The client's IT director wants you to 'scroll through everything, email screenshots to the CEO, then wipe the phone and give it back to the employee.' The phone battery is at 8%, and the employee is on vacation until Tuesday. Litigation is likely. You have no forensic examiner on staff; your usual vendor can arrive Monday at 9 a.m. The client asks what to do tonight.
1. Identify the chain-of-custody and evidence-integrity errors in the client's plan.
Read the worked answer
The plan contains several serious errors. Scrolling through the phone changes the device state and can alter timestamps, read receipts, and sync status. Emailing screenshots creates unauthenticated derivatives without a hash or forensic image. Wiping the phone destroys the original evidence and supports a spoliation claim. Returning the phone to the employee before imaging gives him a chance to delete or alter data and breaks continuous custody. The correct approach is to preserve the device as close to its found state as possible, document who found it and where, and avoid accessing content until a forensic image can be made.
2. What should you do with the phone in the next 72 hours? Include documentation, storage, and access control.
Read the worked answer
Photograph the phone in place, note the room, time, finder, and visible condition, including the 8% battery and unlocked screen. Do not scroll or open apps. Place it in a Faraday bag or airplane mode only if doing so does not alter evidence, and document that step. Assign an evidence number, start a chain-of-custody log, and store it in a locked evidence locker with limited access. Obtain written authorization from the client as device owner to preserve and examine it. On Monday, have the forensic examiner create a verified image and hash before anyone reviews content. Log every transfer and keep the original device preserved.
3. How will you authenticate the text messages and screenshots later?
Read the worked answer
Authentication should rest on the original device and a defensible forensic process, not on the screenshots alone. The examiner should document the device identifiers, extraction method, hash values, and date/time settings. A custodian can testify about the phone's issuance, the company's ownership, and the chain of custody. The screenshots can be used as demonstratives, but the underlying forensic image and extraction report should support them. Preserve metadata and avoid editing images. If the employee disputes the messages, the forensic report and device records are the best evidence.